Skill Install Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:38 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent install-safety guard, but it can still authorize skill installation from vague confirmations like “continue” or “OK,” which is too loose for changing installed agent behavior.

Review this skill carefully before installing. Its goal is protective, but approvals should be tightened to require an explicit phrase naming the skill being installed, especially for URL installs, updates, or cases where review fails.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy issues. The description and subsequent operational text are presented in Chinese only, which can impose a specific language on users without any explicit option to choose another language.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger conditions are broad enough to activate on ambiguous user requests such as generic references to installing 'this skill' or installation via unspecified methods. In a safety-guard skill, overbroad triggering can misclassify ordinary conversation as an install request and start a security-sensitive workflow without clear user intent, increasing the chance of unintended installs or consent confusion downstream.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```

**必要操作**：
1. 读取并加载 skill-vetter 的 SKILL.md（路径通常在 `~/.openclaw/workspace/skills/skill-vetter/SKILL.md` 或类似位置）
2. 按照 skill-vetter 技能文档中的审查标准逐项检查
3. 记录所有发现的安全问题

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: Treating a bare reply like '安装' as confirmation is unsafe because the same word may restate the topic or answer a prior clarifying question rather than grant consent after review. Since this skill is intended to block unauthorized installation, ambiguous approval language undermines the explicit-authorization control and could allow installation without a clearly informed user decision.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: Allowing broad acknowledgements like '好的', '继续', and '可以' as install authorization is dangerous because these phrases are commonly used conversationally and may refer to receiving more information or proceeding with review, not actual installation. In this context, the skill's safety guarantee depends on strict, explicit consent, so ambiguous acknowledgements materially weaken the guardrail.

Static analysis

No suspicious patterns detected.